asp.netcore项目授权流程详解

// Microsoft.Extensions.DependencyInjection.PolicyServiceCollectionExtensionsusing System;using Microsoft.AspNetCore.Authorization;using Microsoft.AspNetCore.Authorization.Policy;using Microsoft.Extensions.DependencyInjection;using Microsoft.Extensions.DependencyInjection.Extensions;public static class PolicyServiceCollectionExtensions{public static IServiceCollection AddAuthorizationPolicyEvaluator(this IServiceCollection services){if (services == null){throw new ArgumentNullException("services");}services.TryAddSingleton<AuthorizationPolicyMarkerService>();services.TryAdd(ServiceDescriptor.Transient<IPolicyEvaluator, PolicyEvaluator>());return services;}                //当不想在应用程序中注册授权策略时，直接调用此方法即可。public static IServiceCollection AddAuthorization(this IServiceCollection services){return services.AddAuthorization(null);}        //当需要在应用程序中注册特定的授权策略时，调用这个方法，configure为Action类型的委托方法，入参为AuthorizationOptions 授权配置类，       //可通过该类的AddPolicy方法来进行授权策略的注册。public static IServiceCollection AddAuthorization(this IServiceCollection services, Action<AuthorizationOptions> configure){if (services == null){throw new ArgumentNullException("services");}services.AddAuthorizationCore(configure);services.AddAuthorizationPolicyEvaluator();return services;}}

// Microsoft.Extensions.DependencyInjection.AuthorizationServiceCollectionExtensionsusing System;using Microsoft.AspNetCore.Authorization;using Microsoft.AspNetCore.Authorization.Infrastructure;using Microsoft.Extensions.DependencyInjection;using Microsoft.Extensions.DependencyInjection.Extensions;public static class AuthorizationServiceCollectionExtensions{public static IServiceCollection AddAuthorizationCore(this IServiceCollection services){if (services == null){throw new ArgumentNullException("services");}                //以下这些服务便是上文中介绍的授权流程用到的主要服务类，及具体的默认实现类。services.TryAdd(ServiceDescriptor.Transient<IAuthorizationService, DefaultAuthorizationService>());services.TryAdd(ServiceDescriptor.Transient<IAuthorizationPolicyProvider, DefaultAuthorizationPolicyProvider>());services.TryAdd(ServiceDescriptor.Transient<IAuthorizationHandlerProvider, DefaultAuthorizationHandlerProvider>());services.TryAdd(ServiceDescriptor.Transient<IAuthorizationEvaluator, DefaultAuthorizationEvaluator>());services.TryAdd(ServiceDescriptor.Transient<IAuthorizationHandlerContextFactory, DefaultAuthorizationHandlerContextFactory>());services.TryAddEnumerable(ServiceDescriptor.Transient<IAuthorizationHandler, PassThroughAuthorizationHandler>());return services;}public static IServiceCollection AddAuthorizationCore(this IServiceCollection services, Action<AuthorizationOptions> configure){if (services == null){throw new ArgumentNullException("services");}                //这里的configure便是我们应用程序传入的委托回调方法，用于向AuthorizationOptions类添加授权策略。if (configure != null){services.Configure(configure);}return services.AddAuthorizationCore();}}

        public void ConfigureServices(IServiceCollection services)        {            //添加授权相关服务。            services.AddAuthorization(options =>            {                //往AuthorizationOptions类中添加名为:adminPolicy的授权策略。                //参数：authorizationPolicyBuilder 为AuthorizationPolicyBuilder类。                options.AddPolicy("adminPolicy", authorizationPolicyBuilder =>                {                    authorizationPolicyBuilder.AddAuthenticationSchemes("Cookie");                    //表示用户必须属于admin角色才能访问。                    authorizationPolicyBuilder.AddRequirements(new RolesAuthorizationRequirement(new string[] { "admin" }));                    //表示用户声明中包含名为cardNo的 Claim,并且值为23902390才允许访问，也就是 HttpContext.User.Claims 中包含cardNo,并且值为相应值才能访问。                    authorizationPolicyBuilder.Requirements.Add(new ClaimsAuthorizationRequirement("cardNo", new string[] { "23902390" }));                    //表示用用户名必须是admin才允许访问，AuthorizationBuilder中海油RequireClaim、RequireRole等方法。                    authorizationPolicyBuilder.RequireUserName("admin");                    //只有以上3个Requirement同时满足，该策略才算授权成功                });            });        }

// Microsoft.AspNetCore.Builder.AuthorizationAppBuilderExtensionsusing System;using Microsoft.AspNetCore.Authorization;using Microsoft.AspNetCore.Authorization.Policy;using Microsoft.AspNetCore.Builder;public static class AuthorizationAppBuilderExtensions{public static IApplicationBuilder UseAuthorization(this IApplicationBuilder app){if (app == null){throw new ArgumentNullException("app");}VerifyServicesRegistered(app);                //注册授权中间件。AuthorizationMiddlewarereturn app.UseMiddleware<AuthorizationMiddleware>(Array.Empty<object>());}private static void VerifyServicesRegistered(IApplicationBuilder app){if (app.ApplicationServices.GetService(typeof(AuthorizationPolicyMarkerService)) == null){throw new InvalidOperationException(Resources.FormatException_UnableToFindServices("IServiceCollection", "AddAuthorization", "ConfigureServices(...)"));}}}

// Microsoft.AspNetCore.Authorization.AuthorizationMiddlewareusing System;using System.Collections.Generic;using System.Linq;using System.Threading.Tasks;using Microsoft.AspNetCore.Authentication;using Microsoft.AspNetCore.Authorization;using Microsoft.AspNetCore.Authorization.Policy;using Microsoft.AspNetCore.Http;using Microsoft.Extensions.DependencyInjection;public class AuthorizationMiddleware{private const string AuthorizationMiddlewareInvokedWithEndpointKey = "__AuthorizationMiddlewareWithEndpointInvoked";private static readonly object AuthorizationMiddlewareWithEndpointInvokedValue = new object();private readonly RequestDelegate _next;private readonly IAuthorizationPolicyProvider _policyProvider;public AuthorizationMiddleware(RequestDelegate next, IAuthorizationPolicyProvider policyProvider){_next = next ?? throw new ArgumentNullException("next");_policyProvider = policyProvider ?? throw new ArgumentNullException("policyProvider");}public async Task Invoke(HttpContext context){if (context == null){throw new ArgumentNullException("context");}Endpoint endpoint = context.GetEndpoint();if (endpoint != null){context.Items["__AuthorizationMiddlewareWithEndpointInvoked"] = AuthorizationMiddlewareWithEndpointInvokedValue;}                //这里获取Controller或者Action上标注的一个或者多个[Authorize]特性,                //每个Authorize特性都有一个Policy属性,用于指定一个或者多个授权策略,表示这些策略必须同时满足才算授权通过,                //Roles属性则用于指定用户角色列表,表示用户必须属于这些角色才允许访问,这里的角色控制最终其实也是转换为策略的形式去控制。                //AuthenticationSchemes则用于指定认证方案列表，表示用户访问该资源时采用这些认证方案进行身份认证                //如：[Authorize(AuthenticationSchemes = "cookie", Policy = "adminPolicy", Roles = "admin")]IReadOnlyList<IAuthorizeData> authorizeData = endpoint?.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();                //以下将Controller或者Action上的一个或者多个[Authorize]特性上指定的访问该资源所需要的满足的Policy授权策略列表，                //及访问该资源时用户所需具备的角色列表，以及访问该资源时将采用的认证方案合并到一个策略对象中去，                //也就是说最终返回的这个授权策略包含了访问该资源所需要满足的所有授权策略列表，用户所必须具备的所有用户角色列表，以及采用的所有认证方案列表。AuthorizationPolicy policy = await AuthorizationPolicy.CombineAsync(_policyProvider, authorizeData);if (policy == null){await _next(context);return;}IPolicyEvaluator policyEvaluator = context.RequestServices.GetRequiredService<IPolicyEvaluator>();                //这里首先对当前访问者进行用户身份的认证，认证方案采用的是上面合并过后的一个或者多个认证方案进行认证。AuthenticateResult authenticationResult = await policyEvaluator.AuthenticateAsync(policy, context);                //如果允许匿名访问，则不再进行授权检查。if (endpoint?.Metadata.GetMetadata<IAllowAnonymous>() != null){await _next(context);return;}                //这里对policy中包含的所有授权策略进行一一检查，如果全部验证通过，则表示授权成功，允许用户访问，                //否则根据用户是否已经登录来判定是让用户登录(401-Challenged)还是提示用户没权限访问(403-Forbiden)PolicyAuthorizationResult policyAuthorizationResult = await policyEvaluator.AuthorizeAsync(policy, authenticationResult, context, endpoint);if (policyAuthorizationResult.Challenged){                        //如果授权失败，且用户身份未认证，且指定了认证方案，则调用特定的认证方案的Chanllege方法。if (policy.AuthenticationSchemes.Any()){foreach (string authenticationScheme in policy.AuthenticationSchemes){await context.ChallengeAsync(authenticationScheme);}}                        //如果该资源没有指定任何认证方案，则采用默认的认证方案。else{await context.ChallengeAsync();}}else if (policyAuthorizationResult.Forbidden){                         //如果授权失败，且用户身份已认证，且指定了认证方案，则调用特定的认证方案的Forbid方法来处理禁止访问的处理逻辑。if (policy.AuthenticationSchemes.Any()){foreach (string authenticationScheme2 in policy.AuthenticationSchemes){await context.ForbidAsync(authenticationScheme2);}}                        //如果该资源没有指定任何认证方案，则采用默认的认证方案来处理禁止访问的逻辑else{await context.ForbidAsync();}}else{await _next(context);}}}

// Microsoft.AspNetCore.Authorization.AuthorizationPolicyusing System;using System.Collections.Generic;using System.Linq;using System.Threading.Tasks;public static async Task<AuthorizationPolicy> CombineAsync(IAuthorizationPolicyProvider policyProvider, IEnumerable<IAuthorizeData> authorizeData){if (policyProvider == null){throw new ArgumentNullException("policyProvider");}if (authorizeData == null){throw new ArgumentNullException("authorizeData");}bool flag = false;IList<IAuthorizeData> list = authorizeData as IList<IAuthorizeData>;if (list != null){flag = list.Count == 0;}AuthorizationPolicyBuilder policyBuilder = null;if (!flag){                //这里遍历Controller或者Action上的一个或者多个[Authorize]特性foreach (IAuthorizeData authorizeDatum in authorizeData){if (policyBuilder == null){policyBuilder = new AuthorizationPolicyBuilder();}bool flag2 = true;                        //如果某个[Authorize]特性有指定授权策略,则将该授权策略添加到合并列表中。if (!string.IsNullOrWhiteSpace(authorizeDatum.Policy)){                                //IAuthorizationPolicyPovider 内部其实就是读取 AuthorizationOptions的字典属性中保存的策略,key为策略名称,value为相应的授权策略。AuthorizationPolicy authorizationPolicy = await policyProvider.GetPolicyAsync(authorizeDatum.Policy);if (authorizationPolicy == null){throw new InvalidOperationException(Resources.FormatException_AuthorizationPolicyNotFound(authorizeDatum.Policy));}                                //其实就是将 Requirements 和 AuthenticationSchemes(认证方案列表) 添加到合并后的Requirements及授权方案列表中去。policyBuilder.Combine(authorizationPolicy);flag2 = false;}string[] array = authorizeDatum.Roles?.Split(',');if (array != null && array.Any()){IEnumerable<string> roles = from r in arraywhere !string.IsNullOrWhiteSpace(r)select r.Trim();                                //如果一个[Authorize]特性指定了Roles属性,那么将属性中指定的一个或者多个角色列表添加到合并后的角色列表中去。                               //看RequireRole,其实就是往合并后的Requirements中添加了一个名为:RolesAuthorizationRequirement的RequirementpolicyBuilder.RequireRole(roles);flag2 = false;}string[] array2 = authorizeDatum.AuthenticationSchemes?.Split(',');if (array2 != null && array2.Any()){string[] array3 = array2;                                //将Authorize特性中指定的一个或者多个认证方案添加到合并后的认证方案列表中。foreach (string text in array3){if (!string.IsNullOrWhiteSpace(text)){policyBuilder.AuthenticationSchemes.Add(text.Trim());}}}                        //如果当前Authorize特性既没有指定授权策略,也没有指定角色列表,那么采用默认授权策略(默认授权策略其实就是要求用户身份必须被认证通过)if (flag2){AuthorizationPolicyBuilder authorizationPolicyBuilder = policyBuilder;authorizationPolicyBuilder.Combine(await policyProvider.GetDefaultPolicyAsync());}}}        //如果一个Controller或者Action没有指定任何[Authorize]特性,那么如果启用了授权流程，则采用Fallback策略进行授权检查。if (policyBuilder == null){AuthorizationPolicy authorizationPolicy2 = await policyProvider.GetFallbackPolicyAsync();if (authorizationPolicy2 != null){return authorizationPolicy2;}}return policyBuilder?.Build();}

// Microsoft.AspNetCore.Authorization.Policy.PolicyEvaluatorusing System;using System.Security.Claims;using System.Threading.Tasks;using Microsoft.AspNetCore.Authentication;using Microsoft.AspNetCore.Authorization;using Microsoft.AspNetCore.Authorization.Policy;using Microsoft.AspNetCore.Http;using Microsoft.Extensions.Internal;public class PolicyEvaluator : IPolicyEvaluator{private readonly IAuthorizationService _authorization;public PolicyEvaluator(IAuthorizationService authorization){_authorization = authorization;}        //参数policy是一个合并后的策略，里面包含了访问该资源所采用的所有认证方案列表。public virtual async Task<AuthenticateResult> AuthenticateAsync(AuthorizationPolicy policy, HttpContext context){if (policy.AuthenticationSchemes != null && policy.AuthenticationSchemes.Count > 0){ClaimsPrincipal newPrincipal = null;                        //如果被访问的资源指定了身份认证方案，则采用指定的身份认证方案一一进行认证，并把所有身份认证结果进行合并。                        //认证流程中添加的一个或者多个认证方案，可以在授权流程中被调用进行用户身份的认证，虽然一个应用可以添加多个认证方案，                        //但默认情况下，认证流程只会调用默认的认证方案进行身份认证。foreach (string authenticationScheme in policy.AuthenticationSchemes){AuthenticateResult authenticateResult = await context.AuthenticateAsync(authenticationScheme);if (authenticateResult != null && authenticateResult.Succeeded){newPrincipal = SecurityHelper.MergeUserPrincipal(newPrincipal, authenticateResult.Principal);}}if (newPrincipal != null){context.User = newPrincipal;return AuthenticateResult.Success(new AuthenticationTicket(newPrincipal, string.Join(";", policy.AuthenticationSchemes)));}context.User = new ClaimsPrincipal(new ClaimsIdentity());return AuthenticateResult.NoResult();}                //如果当前被访问的资源没有指定采用何种认证方案进行身份认证，则默认采用认证流程产生的身份认证信息。return (context.User?.Identity?.IsAuthenticated).GetValueOrDefault() ? AuthenticateResult.Success(new AuthenticationTicket(context.User, "context.User")) : AuthenticateResult.NoResult();}        //这个是对合并后的授权策略进行授权检查的方法，内部还是去调用了IAuthorizationService.AuthorizeAsync方法。public virtual async Task<PolicyAuthorizationResult> AuthorizeAsync(AuthorizationPolicy policy, AuthenticateResult authenticationResult, HttpContext context, object resource){if (policy == null){throw new ArgumentNullException("policy");}if ((await _authorization.AuthorizeAsync(context.User, resource, policy)).Succeeded){return PolicyAuthorizationResult.Success();}return authenticationResult.Succeeded ? PolicyAuthorizationResult.Forbid() : PolicyAuthorizationResult.Challenge();}}

// Microsoft.AspNetCore.Authorization.DefaultAuthorizationServiceusing System;using System.Collections.Generic;using System.Security.Claims;using System.Threading.Tasks;using Microsoft.AspNetCore.Authorization;using Microsoft.Extensions.Logging;using Microsoft.Extensions.Options;public class DefaultAuthorizationService : IAuthorizationService{private readonly AuthorizationOptions _options;private readonly IAuthorizationHandlerContextFactory _contextFactory;private readonly IAuthorizationHandlerProvider _handlers;private readonly IAuthorizationEvaluator _evaluator;private readonly IAuthorizationPolicyProvider _policyProvider;private readonly ILogger _logger;public DefaultAuthorizationService(IAuthorizationPolicyProvider policyProvider, IAuthorizationHandlerProvider handlers, ILogger<DefaultAuthorizationService> logger, IAuthorizationHandlerContextFactory contextFactory, IAuthorizationEvaluator evaluator, IOptions<AuthorizationOptions> options){if (options == null){throw new ArgumentNullException("options");}if (policyProvider == null){throw new ArgumentNullException("policyProvider");}if (handlers == null){throw new ArgumentNullException("handlers");}if (logger == null){throw new ArgumentNullException("logger");}if (contextFactory == null){throw new ArgumentNullException("contextFactory");}if (evaluator == null){throw new ArgumentNullException("evaluator");}_options = options.Value;_handlers = handlers;_policyProvider = policyProvider;_logger = logger;_evaluator = evaluator;_contextFactory = contextFactory;}        //这个就是检查授权策略的核心逻辑了，流程就是读取 依赖注入容器中所有注册的实现了IAuthorizationHandler接口的服务，并对其遍历并分别调用服务的HandleAsync方法。        //微软默认注入的IAuthorizationHandler的实现类是： PassThroughAuthorizationHandler，该类主要是找出Requirements中实现了IAuthorizationHandler的Requirement类，并对其调用HandleAsync方法来检查这类Requirement是否授权通过。public async Task<AuthorizationResult> AuthorizeAsync(ClaimsPrincipal user, object resource, IEnumerable<IAuthorizationRequirement> requirements){if (requirements == null){throw new ArgumentNullException("requirements");}                //AuthorizationHandlerContext 上下文中，包含了所有需要进行授权检查的Requirement。AuthorizationHandlerContext authContext = _contextFactory.CreateContext(requirements, user, resource);foreach (IAuthorizationHandler item in await _handlers.GetHandlersAsync(authContext)){await item.HandleAsync(authContext);                        //如果授权检查失败，并且InvokeHandlersAfterFailure为false时，即某一个Requirement检查失败时，是否继续执行剩余的Requirement检查。if (!_options.InvokeHandlersAfterFailure && authContext.HasFailed){break;}}                //这里主要是检查是否所有的Requirement都验证通过，如果都验证通过，那么返回授权成功，否则返回授权失败。AuthorizationResult authorizationResult = _evaluator.Evaluate(authContext);if (authorizationResult.Succeeded){_logger.UserAuthorizationSucceeded();}else{_logger.UserAuthorizationFailed();}return authorizationResult;}public async Task<AuthorizationResult> AuthorizeAsync(ClaimsPrincipal user, object resource, string policyName){if (policyName == null){throw new ArgumentNullException("policyName");}AuthorizationPolicy authorizationPolicy = await _policyProvider.GetPolicyAsync(policyName);if (authorizationPolicy == null){throw new InvalidOperationException("No policy found: " + policyName + ".");}return await this.AuthorizeAsync(user, resource, authorizationPolicy);}}

// Microsoft.AspNetCore.Authorization.DefaultAuthorizationEvaluatorusing Microsoft.AspNetCore.Authorization;public class DefaultAuthorizationEvaluator : IAuthorizationEvaluator{public AuthorizationResult Evaluate(AuthorizationHandlerContext context){                //看HasSucceded源码，其实要授权成功，必须没有显式调用授权失败的方法。if (!context.HasSucceeded){return AuthorizationResult.Failed(context.HasFailed ? AuthorizationFailure.ExplicitFail() : AuthorizationFailure.Failed(context.PendingRequirements));}return AuthorizationResult.Success();}}

// Microsoft.AspNetCore.Authorization.AuthorizationHandlerContextusing System;using System.Collections.Generic;using System.Linq;using System.Security.Claims;using Microsoft.AspNetCore.Authorization;public class AuthorizationHandlerContext{private HashSet<IAuthorizationRequirement> _pendingRequirements;private bool _failCalled;private bool _succeedCalled;public virtual IEnumerable<IAuthorizationRequirement> Requirements{get;}public virtual ClaimsPrincipal User{get;}public virtual object Resource{get;}public virtual IEnumerable<IAuthorizationRequirement> PendingRequirements => _pendingRequirements;public virtual bool HasFailed => _failCalled;public virtual bool HasSucceeded{get{if (!_failCalled && _succeedCalled){return !PendingRequirements.Any();}return false;}}public AuthorizationHandlerContext(IEnumerable<IAuthorizationRequirement> requirements, ClaimsPrincipal user, object resource){if (requirements == null){throw new ArgumentNullException("requirements");}Requirements = requirements;User = user;Resource = resource;_pendingRequirements = new HashSet<IAuthorizationRequirement>(requirements);}        //如果调用了此方法，那么直接进入授权失败流程了，也就是显式告诉应用授权失败了。public virtual void Fail(){_failCalled = true;}        //某个Requirement验证成功，那么将会调用该方法，并从未验证的Requirements列表中移除。public virtual void Succeed(IAuthorizationRequirement requirement){_succeedCalled = true;_pendingRequirements.Remove(requirement);}}

// Microsoft.AspNetCore.Authorization.Infrastructure.PassThroughAuthorizationHandlerusing System.Linq;using System.Threading.Tasks;using Microsoft.AspNetCore.Authorization;public class PassThroughAuthorizationHandler : IAuthorizationHandler{public async Task HandleAsync(AuthorizationHandlerContext context){foreach (IAuthorizationHandler item in context.Requirements.OfType<IAuthorizationHandler>()){await item.HandleAsync(context);}}}

// Microsoft.AspNetCore.Authorization.Infrastructure.RolesAuthorizationRequirementusing System;using System.Collections.Generic;using System.Linq;using System.Threading.Tasks;using Microsoft.AspNetCore.Authorization;using Microsoft.AspNetCore.Authorization.Infrastructure;public class RolesAuthorizationRequirement : AuthorizationHandler<RolesAuthorizationRequirement>, IAuthorizationRequirement{public IEnumerable<string> AllowedRoles{get;}public RolesAuthorizationRequirement(IEnumerable<string> allowedRoles){if (allowedRoles == null){throw new ArgumentNullException("allowedRoles");}if (allowedRoles.Count() == 0){throw new InvalidOperationException(Resources.Exception_RoleRequirementEmpty);}AllowedRoles = allowedRoles;}protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, RolesAuthorizationRequirement requirement){if (context.User != null){bool flag = false;if (requirement.AllowedRoles != null && requirement.AllowedRoles.Any()){flag = requirement.AllowedRoles.Any((string r) => context.User.IsInRole(r));}if (flag){context.Succeed(requirement);}}return Task.CompletedTask;}}

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)        {            if (env.IsDevelopment())            {                app.UseDeveloperExceptionPage();            }            else            {                app.UseExceptionHandler("/Home/Error");                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.                app.UseHsts();            }            app.UseHttpsRedirection();            app.UseStaticFiles();            app.UseRouting();            //启用认证流程。            app.UseAuthentication();           //启用授权流程            app.UseAuthorization();            app.UseEndpoints(endpoints =>            {                //RequireAuthorization表示所有Controller都需要登录后才能访问。                endpoints.MapDefaultControllerRoute().RequireAuthorization();            });        }